Hi,
This is not a switch-specific problem. Instead, these are events generated by a PCM security plugin called NIM (Network Immunity Manager) that you apparently are trying out along with your trial version of PCM. Among other things, NIM analyzes sFlow data collected from devices throughout your network to look for traffic patterns that could indicate malicious behavior on the network; if it finds something that looks like a possibility it generates events of the sort you are asking about to tell you what behavior it found, who's doing it, and who they're doing it to. The fact that the events are listed for your switch simply indicates that your switch provided the majority of sFlow data that was used to detect the reported behaviors.
The first event you listed reports an IP sweep. It means that the offender (192.168.202.8) has been contacting an unusually large number of IP addresses in a short period of time (using small IP frames in this case since it's a small frame IP sweep, which is often more indicative of an attack than sweeps using larger frames). An IP sweep could indicate that software on the offender system is probing the network to see if there are unused IP addresses or to see if it can find a system that is vulnerable. This behavior could also occur for many non-malicious reasons, for example if the reported offender node hosts some sort of network or host management application that is expected to be polling a large number of IP addresses periodically. If this turns out to be expected behavior you can configure NIM to tell it not to report this kind of behavior from the offender anymore so that you don't have to see the same events continue since you're already concluded that they're not malicious.
The second event you listed is a TCP ACK port sweep, which means that the offender (192.168.202.254) contacted an unusually large number of TCP ports on the victim (192.168.202.183) in a short period of time using TCP ACKs. Given the offender node name (firewall) and the fact that the ports ACKed to are all HTTP alternates I'm guessing that there is nothing malicious here, though it's pretty interesting behavior to note. This traffic pattern can indicate an offender searching for a vulnerable port on the victim node. As with the IP sweep, if you determine that this traffic is innocuous and don't wish for further events of this type from this offender to be reported, just configure NIM so that it ignores this behavior for the offender IP from now on.
Hopefully you find this kind of information useful. NIM has turned up malicious attacks for many customers, but almost all of its users find that it's very good at educating them as to the traffic patterns that exist on their network even when it doesn't turn up anything malicious. After you've "tuned" NIM so that you feel it's only reporting behaviors that may indeed indicate malware or a worm on the network you can even configure it to mitigate the spread of the potential issue by applying switch-based rate limiting to the port where the offender is connected to the network, putting the offender's port on a quarantine VLAN, or even enacting a MAC lockout against the offender or shutting their port off altogether so that they can't do anything more until you've looked at their system to investigate.
Regards,
SVB